CVE-2026-33579 | BDVDB-2026-323917 Detail

Description#

OpenClaw before 2026.3.28 contains a privilege escalation vulnerability in the /pair approve command path that fails to forward caller scopes into the core approval check. A caller with pairing privileges but without admin privileges can approve pending device requests asking for broader scopes including admin access by exploiting the missing scope validation in extensions/device-pair/index.ts and src/infra/device-pairing.ts.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-03-31Record published in the CVE List.
2. Version 22026-09-24Most recent update recorded in the CVE List.